Re: [PATCH bpf-next 08/18] bpf: Support stack arguments for kfunc calls

bot+bpf-ci
2026-04-24T18:00:40Z

[-- Attachment #1: Type: text/plain, Size: 2582 bytes --]

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 6994536b4e04..43aeb04f488a 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -12304,7 +12314,10 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
> reg_arg_name(env, argno));
> return -EINVAL;
> }
> - ret = mark_chain_precision(env, regno);
> + if (regno >= 0)
> + ret = mark_chain_precision(env, regno);
> + else
> + ret = mark_stack_arg_precision(env, i);
> if (ret < 0)
> return ret;
> meta->arg_constant.found = true;

[ ... ]

> @@ -12329,7 +12342,10 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
> }
>
> meta->r0_size = reg->var_off.value;
> - ret = mark_chain_precision(env, regno);
> + if (regno >= 0)
> + ret = mark_chain_precision(env, regno);
> + else
> + ret = mark_stack_arg_precision(env, i);
> if (ret)
> return ret;
> }

In the v6 review, Sashiko AI pointed out that setting reg->precise = true
without calling mark_chain_precision() breaks data-flow backtracking. The
concern was that if only the current state's flag is set, parent states and
source registers that populated the stack argument won't be marked precise,
potentially allowing incorrect state pruning when execution paths merge before
the stack store.

The author acknowledged this issue in the v6 discussion with "You are right.
Let me think how to resolve this." However, the current v7 code still calls
mark_stack_arg_precision() for stack arguments in check_kfunc_args().

Does mark_stack_arg_precision() properly handle backtracking through parent
states? Looking at the two locations where stack argument precision is tracked:

check_kfunc_args() for is_kfunc_arg_const_mem_size():
if (regno >= 0)
ret = mark_chain_precision(env, regno);
else
ret = mark_stack_arg_precision(env, i);

check_kfunc_args() for KF_ARG_PTR_TO_ALLOC_BTF_ID with is_ret_buf_sz:
if (regno >= 0)
ret = mark_chain_precision(env, regno);
else
ret = mark_stack_arg_precision(env, i);

Is mark_stack_arg_precision() correctly marking parent states and the source
registers that stored values into the stack argument slots, or does it only
mark the current state as the v6 review suggested?

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24902767240